Skip to content

Commit

Permalink
unpack-trees: make sure "df_conflict_entry.name" is NUL terminated.
Browse files Browse the repository at this point in the history
The structure that ends with a flexible array member (or 0
length array with older GCC) "char name[FLEX_ARRAY]" is
allocated on the stack and we use it after clearing its entire
size with memset.  That does not guarantee that "name" is
properly NUL terminated as we intended on platforms with more
forgiving structure alignment requirements.

Reported breakage on m68k by Roman Zippel.

Signed-off-by: Junio C Hamano <junkio@cox.net>
  • Loading branch information
Junio C Hamano committed Dec 4, 2006
1 parent 562cefb commit 0fb1eaa
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions unpack-trees.c
Original file line number Diff line number Diff line change
Expand Up @@ -370,7 +370,7 @@ int unpack_trees(struct object_list *trees, struct unpack_trees_options *o)
int i;
struct object_list *posn = trees;
struct tree_entry_list df_conflict_list;
struct cache_entry df_conflict_entry;
static struct cache_entry *dfc;

memset(&df_conflict_list, 0, sizeof(df_conflict_list));
df_conflict_list.next = &df_conflict_list;
Expand All @@ -381,8 +381,10 @@ int unpack_trees(struct object_list *trees, struct unpack_trees_options *o)
state.refresh_cache = 1;

o->merge_size = len;
memset(&df_conflict_entry, 0, sizeof(df_conflict_entry));
o->df_conflict_entry = &df_conflict_entry;

if (!dfc)
dfc = xcalloc(1, sizeof(struct cache_entry) + 1);
o->df_conflict_entry = dfc;

if (len) {
posns = xmalloc(len * sizeof(struct tree_entry_list *));
Expand Down

0 comments on commit 0fb1eaa

Please sign in to comment.